Ransomware Filtering and Removal Expertise Leeds

Ransomware : Your Feared IT Nightmare
Ransomware has become a modern cyberplague that presents an enterprise-level threat for businesses unprepared for an attack. Different versions of crypto-ransomware such as Reveton, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for a long time and continue to cause havoc. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, along with daily unnamed viruses, not only encrypt online data files but also infiltrate any configured system protection. Files replicated to the cloud can also be encrypted. In a poorly architected system, it can make automated restoration hopeless and effectively knocks the datacenter back to zero.

Retrieving applications and data after a crypto-ransomware outage becomes a race against the clock as the targeted organization tries its best to stop lateral movement, cleanup the ransomware, and restore business-critical operations. Since ransomware takes time to spread throughout a targeted network, penetrations are frequently launched during weekends and nights, when successful attacks in many cases take more time to notice. This multiplies the difficulty of rapidly mobilizing and orchestrating a knowledgeable response team.

Progent has a variety of help services for securing Leeds enterprises from ransomware attacks. Among these are team training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat protection to discover and extinguish zero-day malware assaults. Progent in addition offers the services of seasoned ransomware recovery consultants with the track record and perseverance to restore a breached network as urgently as possible.

Progent's Ransomware Restoration Services
After a ransomware event, even paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will provide the needed keys to decipher any or all of your information. Kaspersky Labs estimated that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to re-install the key parts of your IT environment. Absent access to full data backups, this requires a wide complement of IT skills, professional team management, and the willingness to work continuously until the job is completed.

For twenty years, Progent has made available expert Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded high-level certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in accounting and ERP application software. This breadth of expertise gives Progent the capability to efficiently identify important systems and organize the surviving parts of your IT system following a crypto-ransomware attack and rebuild them into a functioning system.

Progent's recovery group utilizes state-of-the-art project management applications to orchestrate the complex restoration process. Progent appreciates the urgency of acting swiftly and in unison with a customer's management and Information Technology resources to assign priority to tasks and to get essential services back online as fast as humanly possible.

Client Story: A Successful Ransomware Intrusion Recovery
A small business hired Progent after their organization was attacked by Ryuk ransomware. Ryuk is thought to have been created by North Korean government sponsored hackers, possibly using technology leaked from the United States National Security Agency. Ryuk attacks specific organizations with little or no room for operational disruption and is among the most lucrative instances of crypto-ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in the Chicago metro area with around 500 employees. The Ryuk attack had brought down all essential operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the time of the intrusion and were encrypted. The client was evaluating paying the ransom demand (exceeding $200,000) and wishfully thinking for good luck, but ultimately brought in Progent.

Progent worked hand in hand the client to quickly assess and assign priority to the key services that had to be restored in order to restart departmental functions:

• Microsoft Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to recover Active Directory to its pre-intrusion state. Progent then assisted with rebuilding and hard drive recovery of essential systems. All Exchange data and configuration information were intact, which facilitated the restore of Exchange. Progent was able to find local OST files (Outlook Off-Line Folder Files) on team PCs to recover mail data. A recent offline backup of the businesses accounting systems made them able to restore these essential applications back online for users. Although significant work remained to recover fully from the Ryuk virus, core systems were returned to operations quickly:

During the following few weeks important milestones in the recovery project were completed through tight collaboration between Progent team members and the client:

• In-house web sites were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million historical emails was brought on-line and available for users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control functions were completely functional.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Most of the user desktops were back into operation.

Conclusion
A likely company-ending disaster was evaded through the efforts of results-oriented professionals, a broad range of knowledge, and tight collaboration. Although upon completion of forensics the ransomware virus incident detailed here could have been identified and disabled with up-to-date security solutions and security best practices, team education, and appropriate incident response procedures for data backup and keeping systems up to date with security patches, the reality is that state-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware attack, remember that Progent's team of experts has extensive experience in crypto-ransomware virus blocking, remediation, and file recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Leeds
For ransomware system recovery services in the Leeds metro area, phone Progent at 800-462-8800 or visit Contact Progent.